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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in tliis application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . 1^ This communication is responsive to applicant's aroument of 7/02/04 . 

2. The allowed claim(s) is/are 1,4-13, 15. 16,27-31,35,36,38-49 and 51-53: now renumbered as 1-35 . 

3. O The drawings filed on are accepted by the Examiner. 

4. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a)n All b)nSome* c) □ None of the: 

1- D Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

5. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

6. lEI CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) S including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1 ) M hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mall Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 
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EXAMINER'S AMENDMENT 



1 . An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

2. Authorization for this examiner's amendment was given in a telephone interview 
with Mr. Albert Michalik (Reg. No. 37,395) on 10/21/04. 

In the claims: 

a. Claim 1; 

- line 2, insert after "driver" - , wherein the request is a function 
call in a kernel component of an operating system -; 

- line 3, insert after "monitored" - , wherein determining that the 



kernel mode driver is to be monitored includes checking a 



registry setting 



b. 



Cancel claims 2 and 3; 



c. 



Claim 4; 



- line 2, insert before "driver" - kernel mode -; 



- line 3, insert after "the" - kernel mode 
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d. Claim 5; 

- line 2, insert before "driver" - kernel nnode 

- line 3, insert after "the" - kernel mode --; 

e. Claim 6; 

- line 2, insert before "driver'' - kernel nnode 

- line 3, insert after "the" - kernel mode --; 

f. Claim 7; 

- line 2, insert after "the" - kernel mode -; 

- line 3, insert after "the" - kernel mode --; 

g. Claim 8; 

- line 1 , insert before "driver" - kernel mode 

h. Claim 9; 

- line 1 , insert before "driver" - kernel mode 

i. Claim 11; 

- line 2, insert after "the" - kernel mode --; 
j. Claim 12; 

- line 2, insert after "the" - kernel mode --; 

- line 3, insert after "the" - kernel mode --; 

- line 3, insert after "at" - kernel mode -; 
k. Claim 13; 

- line 2, insert after "the" - kernel mode --; 
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I. Cancel ciaim 14; 

m. Claim 15; 

- line 2, insert after "invalidating" - kernel mode -; 
n. Claim 16; 

- line 2, insert after "the" - kernel mode -; 

o. Cancel claims 17-26; 

p. Claim 27; 

- Replace claim 27 with the following: 

- A computer-readable medium having computer-executable 
instructions, comprising instructions for: 

- receiving a request from a kernel nnode driver for allocation of 
memory space; 

- determining that the kernel mode driver is to be monitored, 
wherein determining that the kernel mode driver is to be 
monitored includes checking a registry setting; 

- determining a location of memory space to allocate; 

- re-vectoring the request to a kernel mode driver verifier; 

- in the kernel mode driver verifier, testing the kernel mode driver 
including marking the memory bounding the memory space to 
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detect improper access of the memory bounding the memory 
space; 

- allocating the memory space; 

- and monitoring the areas bounding the location for an access 
violation using the kernel mode driver verifier. -; 

q. Claim 28; 

- line 2, insert after "comprising," - instructions for -; 
r. Claim 29; 

- line 2, insert after "comprising," - instructions for, --; 

- line 3, replace "the component" with — kernel mode driver -; 
s. Claim 30; 

- line 2, insert "comprising," - instructions for -; 
t. Claim 31; 

- line 2, insert before ":" - instructions for, --; 

- line 4, insert after ";" - determining that the kernel mode driver 
is to be monitored, wherein determining that the kernel mode 
driver is to be monitored includes checking a registry setting; -; 

- line 6, insert before "driver" - kernel mode -; 

- line 8, insert after "the" - kernel mode --; 

- line 1 0, insert before "driver" ~ kernel nnode -; 
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u. 



Cancel clainns 32-34; 



V. 



Claim 35; 



- line 1 , insert after "monitoring" - kernel nnode --; 

- line 3, insert before "drivers" - kernel mode -; 

- line 5, insert after "requesting" - kernel mode -; 

- line 5, insert before ";" with - , wherein the determining whether 
the requesting kernel mode drivers are to be monitored is based 
on a setting in a registry --; 

- line 6, insert after "a" - kernel mode -; 

- line 7, insert after "a" - kernel mode -; 

- line 8, insert after "the" - kernel mode -; 

- line 9, insert after "from the" - kernel mode --; 

- line 9, insert before "driver verifier" - kernel mode -; 

- line 10, insert after "the" - kernel mode --; 



w. Cancel claim 37; 

X. Claim 38; 

- line 1 , replace "37" with - 35 --; 
y. Claim 39; 

- line 2, insert before "driver includes" - kernel mode -; 
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- line 2, insert after "the" - kernel nnode --; 
z. Claim 40; 

- line 2, insert before "driver includes" - kernel nnode 

- line 2, insert after "the" - kernel mode --; 
aa. Claim 41; 

- line 1 , insert before "driver" - kernel mode --; 

- line 2, insert after "the" - kernel mode -; 
bb. Claim 42; 

- line 2, insert before "driver includes" - kernel mode 

- line 2, insert after "to the" - kernel mode -; 
cc. Claim 43; 

- line 2, insert before "driver" - kernel mode -; 

- line 3, insert after "the" - kernel mode -; 
dd. Claim 44; 

- line 2, insert after "the" - kernel mode -; 
ee. Claim 45; 

- line 2, insert after "the" - kernel mode -; 
ff. Claim 46; 

- line 2, insert after "the" - kernel mode --; 
gg. Claim 47; 

- line 2, insert after "the" - kernel mode -; 
hh. Claim 48; 
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- line 2, replace "system components" with - a plurality of kernel 
mode drivers --; 

- line 3, replace "a system component;" with -- one of the kernel 
mode drivers; 

- determining that one of the kernel mode driver is to be 
monitored, wherein determining that the kernel mode driver is to 
be monitored includes checking a registry setting; --; 

- line 4, insert after "services" - by re-vectoring the request -; 

- line 4, insert before "," - to a kernel mode driver verifier -; 
ii. Claim 49; 

- line 1 , replace "system component" with -- kernel mode driver -; 
jj. Cancel claim 50; 

kk. Claim 53; 

- Replace claim 53 with the following: 

- A computer-readable medium having computer-executable 
instructions, comprising instructions for verifying kernel mode 
drivers: 

- selecting one or more tests for verifying functionality of one of 
the kernel mode drivers; 
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- determining that the kernel mode driver is to be monitored, 
wherein determining that the kernel mode driver is to be 
monitored includes checking a registry setting; 

- modifying a request for system services by re-vectoring the 
request to include execution of the selected tests to a kernel 
mode driver verifier, wherein one of the tests includes restricting 
access to a resource, such that an attempted access to the 
resource causes an access violation; 

- executing the modified request; 

- and generating errors for any test failures. --; 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Charles E Anya whose telephone number is (703) 305- 
341 1 . The examiner can normally be reached on M-F (8:30-6:00) First Friday off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor. An Meng-Ai can be reached on (703) 305-9678. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 



Application/Control Number: 09/447,501 



Page 10 



Art Unit: 2126 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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